A vulnerability was determined in ag2ai ag2 up to 0.13.4. (CVE-2026-108543)

CVE-2026-108543 describes a path traversal vulnerability in ag2ai ag2 versions up to 0.13.4. The issue arises from improper handling of the filename argument in the os.path.join function within the UserProxyAgent component, allowing attackers to manipulate file paths remotely. This can lead to unauthorized information disclosure, integrity compromise, and availability impact. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not issued any response or fix.

Successful exploitation can lead to unauthorized file system access or modification due to path traversal. The CVSS score of 6.3 reflects a medium severity with impacts on confidentiality, integrity, and availability. Remote attackers with limited privileges can carry out the attack without user interaction. No evidence of active exploitation in the wild has been reported.

No official fix or patch is currently available as the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the vulnerable component and applying network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.